I've recently seen 3 different people encounter a problem where a Windows Challenge and Response password prompt occurs for all cfm requests with CFMX 6.1 on Windows 2003 with IIS6. At least two of them were running the CFMX Service as a user other than the default System account. The problem was solved for them by adding Everyone with Full Control to the Security propteries for the helper dll named C:CFusionMX untimelibwsconfig1jrun_iis6_wildcard.dll. Originally, they had only Administrators and System listed in the Security properties, but adding the ColdFusion user account with Full Control wasn't sufficient, so we used Everyone as a test.

Clearly this is not a good security practice to allow Everyone full control of the dll, but I left it up them to narrow down exactly which lower security restriction was minimally sufficent in each case.